recipe
Warn
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a workflow engine that executes CLI tools (e.g., trivy, gitleaks, semgrep) defined in recipe files. User parameters are interpolated directly into shell command strings, which can lead to command injection if not properly sanitized.
- [PROMPT_INJECTION]: The Jinja-style template system used for both prompts and commands creates a surface for injection. Malicious parameter values can be used to override instructions or execute unauthorized commands.
- [PROMPT_INJECTION]: The skill processes untrusted recipe files and converts existing skills, creating an indirect injection surface.
- Ingestion points: Recipe files in
~/.claude/recipes/andSKILL.mdfiles during conversion. - Boundary markers: None; the system uses
{{ }}delimiters which do not isolate untrusted content from the surrounding instructions. - Capability inventory: Execution of CLI tools, file system access via MCP servers, and agent task routing.
- Sanitization: The skill documentation mentions sanitization, but the examples demonstrate direct interpolation of parameters into shell command arguments.
Audit Metadata